Wizard Spider

Last updated

Wizard Spider, also known as Trickbot, DEV-0193, UNC2053, or Periwinkle Tempest, [1] was a cybercrime group based in and around Saint Petersburg in Russia. [2] [3] [4] Some members may be based in Ukraine. [3] They are estimated to number about 80, some of them may not know they are employed by a criminal organisation. [2] [5]

Contents

The group has been a target of Europol, Interpol, FBI and also the National Crime Agency in the United Kingdom. [2]

History

In 2018 the groups began using Trickbot, Ryuk and Conti ransomware as their primary tools. [2]

They have also developed espionage software Sidoh which only gathers information and does not hold it to ransom. [3] [6]

In 2020 their software infected three Minnesota medical facilities, locking staff out of computers. [7]

Court orders were used in 2020 to try to shut down the gangs command and control servers. [7] [8]

By the start of February 2022 some internal communications from the group had been leaked. [9]

In late February 2022, the group initially supported the Russian invasion of Ukraine. [10] [11] In response to this, further leaks happened by an anonymous person in support of Ukraine. [12] [13] [14]

The groups servers were eventually shut down in 2022. [7] [15]

In February 2023 United States Secretary of State Antony Blinken announced that the United States and United Kingdom had sanctioned seven men for allegedly spreading Conti, Ryuk and Trickbot malware. [16] Travel bans were imposed on them, their assets were seized and American and British companies and citizens are prohibited from conducting any business with them. [16] Their names were Vitaliy Kovalev, Valery Sedletski, Valentin Karyagin, Maksim Mikhailov, Dmitry Pleshevskiy, Mikhail Iskritskiy and Ivan Vakhromeyev. [16] Also, any foreign banks that knowingly provide significant services to those men could also be sanctioned. [16]

In September 2023 the USA and UK sanctioned another 11 men connected to Wizard Spider. [7] Their assets in the USA and UK are to be seized and travel bans imposed on them. [7] Wizard Spider was lined to Russian intelligence by the American government. [7] The men named were:

NameRoleAliases
Andrey Zhuykov [7] senior administrator [7] Dif, Defender [7]
Maksim Galochkin [7] test leader [7] Bentley, Crypt, and Volhvb [7]
Maksim Rudenskiy [7] software development leader [7]
Mikhail Tsarev [7] human resources and finance [7] Mango, Alexander Grachev, Super Misha, Ivanov Mixail, Misha Krutysha, and Nikita Andreevich Tsarev [7]
Dmitry Putilin [7] purchase of infrastructure [7] Grad, Staff [7]
Maksim Khaliullin [7] human resources manager, procurement of servers and other infrastructure [7] Kagas [7]
Sergey Loguntsov [7] software developer [7]
Vadym Valiakhmetov [7] software developer [7] Weldon, Mentos, and Vasm [7]
Artem Kurov [7] software developer [7] Naned [7]
Mikhail Chernov [7] internal utilities [7] Bullet [7]
Alexander Mozhaev [7] administrative team [7] Green, Rocco [7]

Other indictments were unsealed, including one in southern California against Maksim Galochkin, on three charges of hacking and deploying Conti on Scripps health hospitals. [7]

As of October 2024 it was disbanded. [17]

Modus operandi

PRODAFT wrote a technical report describing their attacks and organisation. Attacks usually begin by sending large amounts of spam to targets in order to trick victims into downloading malware. They use Qbot and SystemBC malware, as well as writing their own. A separate team pinpoints valuable targets and uses Cobalt Strike to attack them. If they gain control of the system, they deploy ransomware. [18]

They have simultaneously transferred Bitcoin from Ryuk and Conti ransomware attacks into their own wallets, implying they are carrying out several attacks using different malware. [3]

They are very security conscious and do not openly advertise on the darknet. They will only work with or sell access to criminals they trust. They are known to belittle their victims via a leak site. [2] The leak site is also used to publish data they have stolen. [3]

Intelligence agencies say that the group does not attack targets in Russia, nor do key figures travel outside the country for fear of being arrested. [2] [3] The Irish Times reports Wizard Spider software is programmed to uninstall itself if it detects that the system uses the Russian language or if the system has an IP address in the former Soviet Union. [3] However, research by PRODAFT found the majority of SystemBC-infected machines to be within Russia (20.5%). [18]

Russia is suspected of tolerating Wizard Spider and even assisting them. [3]

Suspected attacks

They are suspected of being behind the Health Service Executive cyberattack in the Republic of Ireland. [19] [2] It is the largest known attack against a health service computer system. [3]

Key figures are suspected of being involved with online attacks using Dyre software. [2]

Associates

They are linked to UNC1878, TEMP.MixMaster, and Grim Spider. [5]

According to a report by Jon DiMaggio entitled Ransom Mafia: Analysis of the world's first ransomware cartel the group is part of a collections of criminals known as the Ransom Cartel or Maze Cartel. [3] They are the largest of the groups active in the cartel. [3] [6] The other members are: TWISTED SPIDER, VIKING SPIDER, LockBit gang and SunCrypt gang. [3] All use ransomware to extort money. [3] [6] SunCrypt have since retired. [6]

The PRODAFT report authors found that Wizard Spider sometimes backed up data to a server and that the server contained data from systems that had also been attacked by REvil, though the authors could not conclude which of the two groups had taken the data. [18]

Related Research Articles

Ransomware is a type of malware that permanently blocks access to the victim's personal data unless a "ransom" is paid. While some simple ransomware may lock the system without damaging any files, more advanced malware uses a technique called cryptoviral extortion. It encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them. In a properly implemented cryptoviral extortion attack, recovering the files without the decryption key is an intractable problem, and difficult-to-trace digital currencies such as paysafecard or Bitcoin and other cryptocurrencies are used for the ransoms, making tracing and prosecuting the perpetrators difficult.

Dridex, also known as Bugat and Cridex, is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word.

<span class="mw-page-title-main">Petya (malware family)</span> Family of encrypting ransomware discovered in 2016

Petya is a family of encrypting malware that was first discovered in 2016. The malware targets Microsoft Windows–based systems, infecting the master boot record to execute a payload that encrypts a hard drive's file system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system.

REvil was a Russia-based or Russian-speaking private ransomware-as-a-service (RaaS) operation. After an attack, REvil would threaten to publish the information on their page Happy Blog unless the ransom was received. In a high profile case, REvil attacked a supplier of the tech giant Apple and stole confidential schematics of their upcoming products. In January 2022, the Russian Federal Security Service said they had dismantled REvil and charged several of its members.

Trickbot was a trojan for Microsoft Windows and other operating systems. Its major function was originally the theft of banking details and other credentials, but its operators have extended its capabilities to create a complete modular malware ecosystem.

Ryuk is a type of ransomware known for targeting large, public-entity Microsoft Windows cybersystems. It typically encrypts data on an infected system, rendering the data inaccessible until a ransom is paid in untraceable bitcoin. Ryuk is believed to be used by two or more criminal groups, most likely Russian or Ukrainian, who target organizations rather than individual consumers.

Emsisoft Ltd. is a New Zealand-based anti-virus software distributed company. They are notable for decrypting ransomware attacks to restore data.

FIN7, also called Carbon Spider, ELBRUS, or Sangria Tempest, is a Russian criminal advanced persistent threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. A portion of FIN7 is run out of the front company Combi Security. It has been called one of the most successful criminal hacking groups in the world. FIN7 is also associated with GOLD NIAGARA, ITG14, ALPHV and BlackCat.

DarkSide is a cybercriminal hacking group, believed to be based in Russia, that targets victims using ransomware and extortion; it is believed to be behind the Colonial Pipeline cyberattack. It is thought that they have been able to hack and extort money from around 90 companies in the USA alone. The group provides ransomware as a service.

<span class="mw-page-title-main">Health Service Executive ransomware attack</span> 2021 cyber attack on the Health Service Executive in Ireland

On 14 May 2021, the Health Service Executive (HSE) of Ireland suffered a major ransomware cyberattack which caused all of its IT systems nationwide to be shut down.

Conti is malware developed and first used by the Russia-based hacking group "Wizard Spider" in December, 2019. It has since become a full-fledged ransomware-as-a-service (RaaS) operation used by numerous threat actor groups to conduct ransomware attacks.

On October 27, 2021, a Russian hacker group known as Grief published 13 documents attributed to the National Rifle Association of America (NRA) in a ransomware scam, claimed to have hacked the organization, and threatened to release more NRA documents if the undisclosed ransom was not paid.

Hive was a ransomware as a service (RaaS) operation carried out by the eponymous cybercrime organization between June 2021 and January 2023. The group's purpose was to attack mainly public institutions to subsequently demand ransom for release of hijacked data.

Clop is a cybercriminal organization known for its multilevel extortion techniques and global malware distribution. It has extorted more than $500 million in ransom payments, targeting major organizations worldwide. Clop gained notoriety in 2019 and has since conducted high-profile attacks, using large-scale phishing campaigns and sophisticated malware to infiltrate networks and demand ransom, threatening to expose data if demands are not met.

<span class="mw-page-title-main">LockBit</span> Criminal hacking organization

LockBit is a cybercriminal group proposing ransomware as a service (RaaS). Software developed by the group enables malicious actors who are willing to pay for using it to carry out attacks in two tactics where they not only encrypt the victim's data and demand payment of a ransom, but also threaten to leak it publicly if their demands are not met.

Royal is a cybercriminal ransomware organization known for its aggressive targeting, its high ransom demands, and its use of double extortion. Royal does not use affiliates.

BlackCat, also known as ALPHV and Noberus, is a ransomware family written in Rust. It made its first appearance in November 2021. By extension, it is also the name of the threat actor(s) who exploit it.

In Q2 of 2013, Akamai Technologies reported that Indonesia topped China with a portion 38 percent of cyber attacks, an increase from the 21 percent portion in the previous quarter. China was at 33 percent and the US at 6.9 percent. 79 percent of attacks came from the Asia Pacific region. Indonesia dominated the attacking to ports 80 and 443 by about 90 percent.

References

  1. ↑ "How Microsoft names threat actors". Microsoft. Retrieved 21 January 2024.
  2. 1 2 3 4 5 6 7 8 Reynolds, Paul (18 May 2021). "'Wizard Spider': Who are they and how do they operate?". RTÉ News . Retrieved 18 May 2021.
  3. 1 2 3 4 5 6 7 8 9 10 11 12 13 Lally, Conor (18 May 2021). "Wizard Spider profile: Suspected gang behind HSE attack is part of world's first cyber-cartel". The Irish Times . Retrieved 19 May 2021.
  4. ↑ Burgess, Matt (1 February 2022). "Inside Trickbot, Russia's Notorious Ransomware Gang". Wired . Retrieved 15 February 2022.
  5. 1 2 "Mapping To Wizard Spider". MITRE Shield. Mitre Corporation. Archived from the original on 28 January 2021. Retrieved 18 May 2021.{{cite web}}: CS1 maint: unfit URL (link)
  6. 1 2 3 4 DiMaggio, Jon. "Ransom Mafia - Analysis of the World's First Ransomware Cartel". Analyst1. Retrieved 19 May 2021.
  7. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 Lyons, Jessica (7 September 2023). "US, UK sanction more Russians linked to Trickbot". The Register . Retrieved 2 October 2024.
  8. ↑ Corfield, Gareth (12 October 2020). "Microsoft and chums use US trademark law to trash Trickbot malware network". The Register . Retrieved 2 October 2024.
  9. ↑ Burgess, Matt (1 February 2022). "Inside Trickbot, Russia's Notorious Ransomware Gang". Wired . Retrieved 2 October 2024.
  10. ↑ Reichert, Corinne (25 February 2022). "Conti Ransomware Group Warns Retaliation if West Launches Cyberattack on Russia". CNET . Retrieved 2 October 2024.
  11. ↑ Bing, Christopher (25 February 2022). "Russia-based ransomware group Conti issues warning to Kremlin foes". Reuters . Retrieved 2 October 2024.
  12. ↑ Corfield, Gareth (28 February 2022). "60,000 Conti ransomware gang messages leaked". The Register . Retrieved 2 October 2024.
  13. ↑ Humphries, Matthew (28 February 2022). "Backing Russia Backfires as Conti Ransomware Gang Internal Chats Leak". PCMag . Retrieved 2 March 2022.
  14. ↑ Faife, Corin (28 February 2022). "A ransomware group paid the price for backing Russia". The Verge . Retrieved 2 October 2024.
  15. ↑ "Something strange is going on with Trickbot". Intel 471. 24 February 2022. Retrieved 2 October 2024.
  16. 1 2 3 4 Lyons, Jessica (10 February 2023). "Conti, Ryuk, Trickbot malware". The Register . Retrieved 2 October 2024.
  17. ↑ Jones, Connor (1 October 2024). "Evil Corp's deep ties with Russia and NATO member attacks exposed". The Register . Retrieved 1 October 2024.
  18. 1 2 3 Burt, Jeff (18 May 2022). "Meet Wizard Spider, the multimillion-dollar gang behind Conti, Ryuk malware". The Register . Retrieved 20 May 2022.
  19. ↑ Molony, Seanan; Weckler, Adrian (17 May 2021). "Cyber experts hunt hidden hacking in all Government departments as Russian hackers target Health". Irish Independent . Retrieved 18 May 2021.
Ruzgar-deneme-yonetici4.png

This organization-related article is a stub. You can help Wikipedia by expanding it.

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.